In kerberos protocol the client, after receiving a ticket to the TGS server, sends a request to the TGS and adds an authenticator to the request.
What if an attacker performs a replay attack within the allowed clock skew, so that the difference between the timestamp in the authenticator the attacker copied and the TGS's clock is still allowed. What kind of check will the TGS perform in such a case ?
If the clock skew is 5 minutes then shouldn't there be some cache memory holding all requests from the last 5 minutes so that if the same authenticator arrives again TGS will reject it since the same timestamp already exists in its cache ? (because a valid client sending a second request would generate a new timestamp while an attacker will use an existing timestamp) ?
Is there such a cache for the case of a replay attack within the allowed time range ?